use address in /48 tunnel for terseness and to allow rDNS